How Do Financial Institutions Comply with Regulations When Using WeChat?

Summary

Financial institutions can use WeChat for client communications, but regulated conversations must be captured, retained, supervised, and retrievable just like communications on other business channels. When firms deal with clients in China, home-market recordkeeping requirements must be reconciled with PIPL and China’s cross-border data rules. 

Key Takeaways

• WeChat is a regulated channel: Business conversations conducted over WeChat are subject to the same recordkeeping and supervision requirements as email, text messages, and other electronic communications.
• Personal WeChat creates off-channel risk: Employee-controlled personal WeChat accounts provide little enterprise visibility, making it difficult for firms to demonstrate that client communications are being captured, retained, and reviewed. 
• WeCom helps, but isn’t enough: WeCom provides enterprise administration and conversation archiving capabilities, but firms still need a compliant workflow for capture, supervision, retention, retrieval, and integration with their regulatory archive.
• China adds another compliance layer: Firms communicating with people in China may also need to address PIPL, sensitive personal information requirements, and restrictions or conditions governing cross-border transfers of communication data.
• Governance must cover the full lifecycle: A compliant WeChat program should create a defensible chain from communication and capture through supervision, archiving, retention, and regulatory retrieval. 

Financial institutions can use WeChat for regulated client communications, but they must treat it as a governed business channel rather than an informal messaging app. That means that U.S. broker-dealers have to capture and retain business-related WeChat messages under SEC Rule 17a-4 and FINRA Rule 3110 recordkeeping rules. EU investment firms have comparable obligations under MiFID II for electronic communications relating to transactions and client orders.

When a firm communicates with clients in China, the collection, processing, storage, and transfer of those communications may also implicate China’s Personal Information Protection Law (PIPL), Cybersecurity Law, Data Security Law, and related cross-border data rules.

It’s that combination that makes WeChat compliance in financial services more complicated than simply switching on an archive. Firms have to satisfy the recordkeeping and supervision requirements imposed by their home-market regulator while also understanding what happens to client data as communications move through the WeChat or WeCom ecosystem and, potentially, into a compliance archive located outside China.

Why Does WeChat Create a Distinct Compliance Program for Financial Institutions?

When it comes to compliance, regulators are more focused on the substance and purpose of a communication than on which app was used to send it. 

If a registered representative subject to FINRA supervision discusses firm business with a client on WeChat, moving that conversation from email to a mobile messaging app doesn’t make the recordkeeping obligation disappear. FINRA explicitly identifies instant messages, text messages, and chat messages as electronic communications that may need to be retained, while SEC rule 17a-4 requires broker-dealers to preserve communications received and sent relating to their business. 

The problem is that WeChat was designed primarily as a consumer communications platform, not as one meant for compliance with SEC, FINRA, or MiFID II rules. A personal WeChat account doesn’t give the financial institution the same centralized administration, supervision, or retention controls it could expect from corporate email. If an employee communicates directly with a client from an unmanaged personal WeChat account, the firm may have little or no visibility into that conversation unless a separate capture mechanism has been implemented. 

That places personal WeChat in the same broad risk category as other off-channel communications that have attracted intense regulatory attention. Over the last few fiscal years, the SEC brought 95 enforcement actions and imposed approximately $2.3 billion in penalties over failures to maintain and preserve off-channel communications. 

WeChat also introduces a second problem that is less prominent with many Western communication platforms because of its prevalence in China specifically. A U.S. or European institution may need to preserve a communication because FINRA, the SEC, or MiFID II requires it. At the same time, if the conversation involves personal information collected or generated in China transferring a copy into an overseas compliance archive can itself become a regulated data activity under Chinese law.

In that case, companies need to make sure they’ve captured the required messages and also keep track of where data originated from, what personal information it contains, where the archive is located, and what legal mechanism allows them to move the data there.

Which Financial Regulations Apply to WeChat Conversations?

As with any other messaging platform, the financial regulations that apply to WeChat conversations are dependent on the type of institution, the employee, the content of the conversation, and the jurisdiction involved. Following are the most likely rules to apply:

FINRA Rules 4511 and 3110

Rule 4511 is known as the “books and records” rule, requiring FINRA member firms to keep and retain accurate records as specified in FINRA rules, the Securities Exchange Act, and applicable Exchange Act rules. FINRA has specifically explained that books and records obligations extend to electronic communications such as instant messages, texts and chat messages in addition to regular email.

In addition to retaining records, FINRA Rule 3110 requires member firms to establish and enforce a supervisory system with written procedures that are reasonably designed to achieve regulatory compliance. FINRA’s examination findings have repeatedly focused on firms that fail to retain or review electronic communications, fail to detect off-channel activity, or maintain policies that don’t clearly identify permitted and prohibited communication platforms.

When it comes to WeChat compliance in financial services, simply telling employees not to use their personal WeChat for business purposes is not necessarily a sufficient supervisory control. Employees should be given an approved way to communicate with clients who expect to use WeChat and mechanisms should be put in place for detecting cases where employees bypass the approved workflow.

FINRA has also highlighted the need to review communications in languages other than English in which a firm does business, which is an especially relevant consideration for firms using WeChat with Mandarin-speaking clients.

SEC Rule 17a-4

SEC Exchange Act Rule 17a-4 requires broker-dealers to preserve the originals of communications received and copies of communications sent relating to the firm’s business. Communications in this category generally need to be kept for at least three years, with the first two years in an easily accessible place. WeChat conversations fall squarely within this rule.

One important technical point has changed in recent years and Rule 17a-4 no longer requires firms to use WORM storage as the only acceptable electronic recordkeeping model. Following SEC amendments that became effective in 2023, broker-dealers can use either WORM storage or an electronic recordkeeping system that maintains a complete time-stamped audit trail allowing an original record to be recreated if it’s modified or deleted. 

MiFID II

For EU investment firms, Article 16(7) of MiFID II requires the recording of telephone conversations and electronic communications relating to transactions and client order services involving the reception, transmission, or execution of orders.

Importantly, the requirement extends to communications intended to result in a transaction, even if the transaction ultimately never occurs. Firms are also required to take reasonable steps to prevent relevant communications from taking place on privately owned equipment that the firm can’t record or copy, which would include the use of personal WeChat accounts.

The China-Side Requirement: PIPL and Cross-Border WeChat Data

Firms dealing with clients in mainland China are very likely to use WeChat, and in China, financial communications compliance can’t be considered separately from Chinese data law. 

China’s regulatory framework includes the Cybersecurity Law, Data Security Law, Personal Information Protection Law (PIPL), and implementing rules governing data transfers. PIPL is particularly important because its reach is not limited to Chinese companies.

Article 3 states that PIPL can apply to organizations outside of China when they process personal information of people located in China for purposes including providing products or services to those individuals or analyzing their behavior. A foreign bank, broker, investment manager or wealth-management firm therefore can’t assume that operating outside China would automatically put any China-facing WeChat communications outside of PIPL.

In fact, the opposite is true especially as PIPL expressly identifies financial account information as sensitive personal information and imposes additional requirements on its processing. 

Under PIPL Articles 38 and 39, transferring personal information outside China can require an approved transfer mechanism and notification to the individual that details who the overseas recipient is, the purpose of sharing the information, the categories of information being shared, and how the individual can exercise their rights. 

These rules are not one-size-fits-all, however. China did relax and clarify parts of its cross-border data regulations in March 2024. For example, certain non-critical-information-infrastructure operators transferring information of fewer than 100,000 individuals from January 1 of a given year may be exempt from requirements to undergo a security assessment, execute the standard cross-border contract, or obtain certification, provided the data isn’t sensitive. Higher-volume and sensitive data transfers can trigger additional requirements. 

PIPL Article 41 states that organizations and individuals may not provide personal information stored in China directly to a foreign judicial or law-enforcement authority without approval from the relevant Chinese authorities. This can create a sensitive interaction between the obligation to preserve and produce records to a home-market regulator (like the SEC) and restrictions governing the overseas disclosure of China-based data. Multinational financial institutions need legal, compliance, privacy, and technology teams to design their WeChat architecture together to take into account all relevant nuances. 

Personal WeChat vs. WeCom: Why the Difference Matters (or Doesn’t) for Compliance

WeCom is the business version of WeChat, but just because it’s an enterprise tool doesn’t make it fully compliant with all relevant regulations. 

The regulatory challenge with a personal WeChat account is that the employee has full control over the account. If that account is being used independently to communicate with clients, the employer doesn’t automatically receive enterprise-level administration or supervision over those conversations. The employee may be conducting perfectly legitimate business, but the firm could be unable to demonstrate that the communication was captured, retained, reviewed, and available for examination. 

WeCom provides enterprise administration and support Tencent’s Conversation Content Archive functionality, through which companies can retrieve qualifying archived communications through APIs when the service is enabled and configured. But this archive capability shouldn’t be confused with a complete SEC, FINRA, or MiFID-ready WeCom compliance solution. Regulated firms still need to determine how the data is ingested, retained, supervised, exported, and ultimately stored in an approved compliance archive. 

How to Build a Compliant WeChat Program

None of the above is to say that companies need to prohibit the use of WeChat. Especially for those operating in China, the customer base will demand the use of it and the best course of action is to create a way for it to be used while remaining in compliance. Here’s how companies can do so:

• Identify where WeChat is already being used: Before designing controls, determine which employees use WeChat or WeCom and in what contexts. Compare actual behavior with the firm’s approved-channel policy to see where changes need to be made.
• Move client-facing activity into a governed workflow: Move employees away from unmanaged personal WeChat conversations and give them a sanctioned way to interact with clients through WeCom or another controlled interface. Rather than prohibiting a channel preferred by clients, make that channel governable. 
• Capture the entire conversation: WeChat conversations often include more than just text, and it’s important to capture rich content as well such as stickers, voice notes, files, and images. Capturing only the text can strip away context that is needed to understand what happened. 
• Apply supervision after capture: Once the data is stored, firms need a way to conduct risk-based reviews, escalation procedures, policy controls, and surveillance capable of handling the languages and communication patterns relevant to their business. 
• Map retention and data location together: US broker-dealer communications can carry three-year Rule 17a-4 retention requirements, FINRA rules can impose different or longer periods depending on the record, and MiFID II recordings are generally retained for five years and potentially seven. Chinese privacy and cross-border rules need to consider whether data can be transferred to the proposed archive location and under what conditions. A global retention schedule has to account for both regulatory preservation and privacy/data requirements together. 
• Test retrieval before a regulator does: Firms should periodically test whether they can produce complete WeChat records, including relevant metadata and attachments, from their archive. FINRA specifically recommends testing third-party recordkeeping vendors by simulating regulatory examinations and requesting records to verify that the vendor can fulfill applicable recordkeeping requirements. 

The objective is a solid chain from communication → capture → supervision → archive → retrieval, with the data-governance controls around that chain documented as clearly and carefully as the messaging policy itself. 

How LeapXpert Supports Compliant WeChat and WeCom Use

WeChat and WeCom can be essential tools for financial institutions serving clients in China, much as LINE is for firms operating in Japan. But allowing employees to communicate through them does not, on its own, satisfy the firm’s regulatory obligations. 

The LeapXpert Communications Platform enables financial institutions to support customer-preferred channels such as WeChat while bringing those interactions into a governed enterprise environment. Communications can be captured and integrated with the organization’s existing archiving, monitoring, and compliance systems without requiring clients to abandon the applications they already use. 

This allows firms to maintain important China-facing client relationships while reducing the risk of regulated conversations taking place outside corporate oversight.

Book a demo to learn more. 

FAQs

Is it legal for a regulated financial firm to use WeChat with clients?

Yes, it is legal for a regulated financial firm to use WeChat with clients. Financial regulations don’t prohibit WeChat by name, but the firm must ensure that any regulated business communications conducted through the app are captured, retained, supervised, and able to be produced as required by the rules that apply to the institution. China-side privacy and cross-border data requirements may also need to be addressed for China-facing communications.

What’s the compliance difference between personal WeChat and WeCom?

Personal WeChat is a consumer account and generally gives an employer no native enterprise supervision over an employee’s independent account. WeCom is designed for enterprise use and offers administrative controls and a Conversation Content Archive capability. Regulated firms still need an appropriate capture, supervision, retention, and archive workflow around WeCom to make sure they are meeting their specific regulatory obligations.

Do FINRA and SEC recordkeeping rules apply to WeChat conversations?

FINRA and SEC recordkeeping rules can apply to WeChat conversations. For FINRA member broker-dealers, business-related WeChat communications can fall within FINRA and Exchange Act books-and-records requirements in the same way that other electronic chat or messaging communications do. 

How does China’s PIPL affect a foreign firm’s WeChat compliance obligations?

PIPL can apply to an organization outside China when it processes personal information of people located in China for purposes such as offering them products or services. When personal information is transferred outside China, PIPL and related CAC rules may require notice, separate consent, and a personal-information protection impact assessment.